Risk in work unit business planning: Overview of the route

Previous article: Risk in work unit business planning: Where it ends

You start with the business plan, whether it is a polished draft or just a general idea of how things are to be. The first step is to re-generate the unit’s objectives for the year, using an approach specifically designed for risk. At this point you can decide which objectives need immediate risk attention for satisfying the boss on the business plan, and which ones can be subject to less urgent risk management.

For each re-generated objective, you define what success looks like, along with a spread of other outcomes better and worse than planned success. You use this spread of outcomes for assessing specific risks and overall risk levels. Each ‘risk consequence’ is nothing more or less than a potential outcome for the year, within one of the unit’s objectives.

There is quite a bit of work involved in getting to this point, but it pays for itself in three ways. First, it makes the risk management process meaningful at the point of answering the boss question about confidence in the plan. You may be vaguely aware that risk management often doesn’t serve that purpose. Secondly, it will make the job of identifying and analysing specific risks much easier than it would have been without customised objectives and consequences. Thirdly, this view of planned and unplanned outcomes against unit objectives has uses beyond risk management, and may also form the basis for performance reporting, forecasting, and so on throughout the planning cycle.

After setting out a spread of possible year-end outcomes on each objective, you start identifying specific risks. Each risk is considered defined when it links a source of uncertainty with a consequence representing an outcome for the year.

You then estimate the likelihood of each risk actually resulting in that outcome.

From those outcome likelihoods you can classify particular slices of risk as acceptable, unacceptable, or doubtful. You can decide whether the likelihood of the outcome being reached is (in your real world) a normal and accepted part of aiming to deliver the key results. This decision can be made for each risk separately, or for all the risks leading to a defined outcome.

Where risk is not clearly acceptable, you have a further decision to make — what to do about it. The first response might be to find a way to change the likelihood of the risk event occurring, or to change the outcome effect if and when the event occurs. Responses that do those things are called controls. Whatever controls are implemented, it will probably have an effect on your expectations for other objectives. There are always trade-offs involved. When you have confirmed the controls you will and won’t be implementing, you re-assess the outcome likelihoods.

If there remain one or more outcomes with likelihoods that are not clearly acceptable, you have something to discuss with the boss.

To the extent that you are relying on controls, you will need to ensure that those controls are actually implemented. That may involve setting up accountability and monitoring.

After all of that, you will definitely be ready to look the boss in the eye over the business plan. The full resolution to outcomes with unacceptable likelihood might be a substantial change to your unit’s role, goals, and strategies, needing boss involvement. It might also be that the boss needs to escalate the situation. Ultimately the organisation might decide that the risk is acceptable for the greater good, with or without actions to be taken elsewhere to limit the exposure.

Most importantly, you will have made it clear that you cannot guarantee the preferred outcome, and that disappointments can definitely happen. You will have set out the reasons in advance. You will therefore not be so readily blamed if something turns out a bit different to the vision in your business plan (and it actually wasn’t your fault).

The process creates a risk based outcomes forecast for the year. The risk based outcomes forecast ties together in a single view planned results, performance, risk, and prospects for the unit. The risk based outcome forecast can be maintained and updated as the central focus of conversations with the boss through the year.

Next article:

Risk in work unit business planning: Assumptions

You’re the expert There will be differences between the recommendations here and guidelines you have been given within your organisation.

Previous article: Risk in work unit business planning: Where it ends

Index to the series